Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Access SolarWinds

gamereck1975

I need to setup a alert to send notification when users access Solarwinds can this be done?

Find more posts tagged with

Accepted answers

All comments

stuartd

The base principle here is: "If the data is in the DB then you should be able to extract it".

We use a fairly simple query that runs in a report to show the last x days of audit events. This is not because we are being all 'big brother' about it, but the audit logs stores a lot more info than just logins or outs.. However, due to the way Solarwinds don't have a proper RBAC solution, then to prevent giving everyone full admin rights we set up a bunch of reports. This way, they can run a report to see when precisely an event happened or something was done.

This is not something we've done, but I suspect the following is a good starting place:

FormerMember

I think this would work too. Or you could setup a report to e-mail you once a day with a historical list of logins for the day.

gamereck1975

That's my plan

adam.beedell

SELECT DISTINCT(data.Accountid) as Account
--, data.AuditEventMessage
, max(data.TimeLoggedUtc) as latesttime
FROM orion.auditingevents AS data
WHERE 1=1
AND [data].[ActionTypeID] = 1
GROUP by data.AccountID--, data.AuditEventMessage
ORDER BY data.AccountID asc
WITH NOLOCK

Add a time where of your choice

stuartd

Yup 100% this is what we do, and IMO works far better than trying to configure an alert for it.

stuartd

Our report is this:

SELECT AE.AuditEventID
	,AE.AuditingActionType.ActionTypeDisplayName AS [Audit Action]
	,AE.AccountID
	,AE.AuditEventMessage AS [Audit Event]
	,AE.TimeLoggedUtc
FROM Orion.AuditingEvents AS AE

And then we just use the reports capability to set today, last 24hrs, last week, etc

N.B. This does NOT restrict to just logons but is all audit data.